Reviewers api auth 1032603

https://bugzilla.mozilla.org/show_bug.cgi?id=1032603

We no longer support cookie base API authentication so we should send the `Authorization` header for AJAX requests to the app. This is handled similarly to [how it is done for CSRF](https://github.com/mozilla/zamboni/blob/a332ca4a09813550c82766705b21a59a5e2f3b4b/media/js/lib/csrf.js).
Since this is typed twice I wonder if there's a place we could put that in a constant variable?