Fix API authentication header
Fix API authentication header

The "Authorization:" HTTP header is RFC-defined with a well-defined
syntax (which we're not following here). This is Bad(TM).

Fix by using a header with an X- prefix, so we don't clash with such
things.

yoe/sreview,yoe/sreview,yoe/sreview,yoe/sreview