Add header support for token authentication

[mwarkentin]

This will be both cleaner, and more secure (not logging authentication token in access logs, etc).

Determine if there's a "standard" authentication header, or if we should just use something like X-Authentication-Token or similar.

[mwarkentin]

Authorization: WATCHMAN-TOKEN Token="<token>"

• http://stackoverflow.com/questions/7802116/custom-http-authorization-header
• http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html

[mwarkentin]

This will be fixed by #75