Use Authentication header with bearer token

[jasny]

Sending the SSO session token as query parameter can be unsafe. These typically appear in access and errors logs. This means ppl who have access to these logs (developers, devops, etc) can abuse these tokens.

Instead we should send an Authentication Bearer header with the session token. See RFC 6750.

For BC the SSO server should accept both.

[infabo]

+1

[jasny]

The server should accept the value through an Authentication: Bearer ... header as well as the access_token query ($_GET) or form ($_POST) parameter.

It should also still accept the session_id query parameter for backwards compatibility.

[jasny]

Fixed in #53