Make sure `uid` is always a string

Don't crete the false expectation that our UIDs are always integers.
Use headers for tokens

We support the Authorization header now, we should use it instead of
sending the token as part of the params.
Update omniauth dependency
Bump version