Fix for API token auth

Removed a breakpoint from HeaderAuth callable.
Modified authenticate to return a future after both auth mechenisims are
evaluated.