Allow GET requests to use the Authorization header in place of exposing the key in the URL