Adjust credential extraction to allow X-Tank-Key

This makes use with some systems a bit easier. Using the
Authorization header can be confusing for automated tools.