Wire things up to use the auth token as an http header, rather than passing the phone number as a url param, which was just a temporary hack before auth.