And now it's the Authorization header, like in Oauth2