Use basic auth instead of X-Token header

This should make it slightly more convenient for http clients to post messages by not making them account for a custom header, and instead using a more conventional approach.