Change authorization from Cookie-based to Header-based Closes #449 See merge request inject/frontend!442