Send auth token in header for relevant requests

Not sure why we're sending it in the POST body as it should already be in the request