Pull auth and refresh tokens out of request headers

[naglepuff]

This will allow us to remove the token from the query string.