Using Auth header, not cookie, for OpenID auth token