Set API token in header after successful log in

Removes appended ?api_token= query string from all requests.