auth: support oauth authorization header.
api: improved var name.
cmd: sending token type in the authorization header.