Allow setting the token via HTTP header

Quick summary: this is very useful for XHR requests where the request body is JSON instead of form encoded data.

For juicy details, see commit messages :)

Not sure if ef65f1f causes information overload, so feel very free to skip that commit.