Reviewers api auth 1032603

https://bugzilla.mozilla.org/show_bug.cgi?id=1032603

We no longer support cookie base API authentication so we should send the `Authorization` header for AJAX requests to the app. This is handled similarly to [how it is done for CSRF](https://github.com/mozilla/zamboni/blob/a332ca4a09813550c82766705b21a59a5e2f3b4b/media/js/lib/csrf.js).
what do you think of this?

```js
function isExternal(url) {
  var a = document.createElement('a');
  a.href = url;
  return a.hostname !== window.location.hostname;
}

if (isExternal(ajaxSettings.url)) {
```