Adding ability to use query param instead of header to pass auth token,
closes #6