I think it should be ``TOKEN_HEADER`` not ``HTTP_TOKEN_LOOKUP`` because I believe it is django that converts it to have the HTTP_ preceding the header name, no?

I'll be looking into the apitopy stuff now.