Add x-auth-formtoken

Suggested by official API document.