Use PRIVATE-TOKEN header for passing the auth token

This moves the `private_token` field from out of the request url and into the request header.