Check for presence of authorization header rather than /login

This should be a little more reliable in case we change the names of
things in the future.