Added apitoken check for auth header as first option.

This is weird functionality that PointDNS seems to implement. Any
username, no matter what it is, will be valid so long as the password part
is a valid api token.