Token-based authentication using GOV.UK SSO

I believe it's related; without setting this header, `gds-sso` doesn't think that the test requests are API calls, because of [how this method works](https://github.com/alphagov/gds-sso/blob/master/lib/gds-sso/api_access.rb#L6).