This uses our own, more secure API authentication token

Replaces the native Spree API key mechanism. This token is accepted in
all the same ways as the Spree API key is on our end, so this change
should be transparent to the Spree Hub.