token-based auth

Still needs tests, but will set an `Authorization: Bearer whatever` header if one is in the configuration.