Allow auth token via header

Haven't tested this out yet but what do you think about this approach @ejholmes ?