Use authorization headers by default for ensureAuthenticated middleware
Remove token querystring from API call