Extend devise :token_authenticable strategy to take token from headers too.