Reviewers api auth 1032603

https://bugzilla.mozilla.org/show_bug.cgi?id=1032603

We no longer support cookie base API authentication so we should send the `Authorization` header for AJAX requests to the app. This is handled similarly to [how it is done for CSRF](https://github.com/mozilla/zamboni/blob/a332ca4a09813550c82766705b21a59a5e2f3b4b/media/js/lib/csrf.js).
`csrf.js` seems like an odd place to initialise this `localRequestCallbacks` variable