Add CardReader functionality and tests
Fix header appending to respect api key vs auth token, not both

[#80581522]