Token-based authentication using GOV.UK SSO

This header doesn't seem to be related to this PR.  Is it necessary?