Add label field to auth token for an indication of where it is used
Allow auth token to be specified via request param instead of cookie