fix #129 Setting token in query params and Authorization header violates spec
Merge remote-tracking branch 'jfromaniello/bug129'
Added an extra test, and checked realHeaders to catch any dodgy custom ones