My understanding (which might be wrong) is that the Authorization header is for Basic and Digest authentication. As we are doing token authentication a custom header feels more appropriate. I've seen this in other APIs so thought it was an ok approach.