Cookie and Query string fallback update to PR #1468

There are situations where resources cannot be retrieved with a request that allows sending headers (direct resource access for images, files, etc.). This modification will allow a fallback to a cookie, or a querystring parameter for token authentication in scenarios where headers are not an option.