Added check for content type and moved POST /api/files to /storage.
Added test coverage for authentication token parsing.
Added test coverage for HTTP file caching header.