add token/secret functionality for worldcat xisbn

This is for institutions who have procured larger per day transfer
limits; it looks like the only way to do this now is by IP or using this
token/secret mechanism.