Can we call this configuration option something like `allow_token_authenticatable_via_headers` or something like it?