Provide the ability to pass the token via HTTP headers instead of a query parameter

[ikopylov]

Passing the publication token via a query parameter is not secure, as the full URL often ends up in logs. This can lead to token leakage through logs. A better strategy is to pass the token via the Authorization header in HTTP.