Auth header for API is now prefixed with X- to follow spec