Add both X-API-Token and X-API-Authenticate for IE in the URI automatically.
Only add X-API-Token when not logging in as ourselves.
When using IE only do CORS from https to https and http to http.