#488 Token authentication can now be done either using a header or a 'token' request aprameter