Authenticate based on X-API-KEY in header

While passing parameters in the body of a GET request isn't expressly
forbidden by the HTTP/1.1 spec, the body shouldn't changed the server's
response. Instead of passing credentials in all requests, this commit
moves the API token into a header of all requests.

See here for more on a GET request with a body:

http://stackoverflow.com/questions/978061/http-get-with-request-body