It has two uses. 

When the client puts the X-Docker-Token in the header for a request, it says it wants an auth token. 

When requested it is the header where we store the Docker auth token in the response.

/cc @samalba