Update to use personal API tokens

Previously, we were relying on authorization cookies, which did not
allow us to restrict access.