migrate to API-SECRET header

@jasoncalabrese pointed out that some agents do odd things with
underscores and that using a hyphen is more common.
This also adds tests to ensure that the API_SECRET handling works as
expected.