Authentication without URIs

[PGijsbers]

Currently we match the PHP API behavior that expects API keys to be encoded in the URI of the requests. We instead want to use an authorization header: https://fastapi.tiangolo.com/reference/security/

[Jayant-kernel]

@PGijsbers
I can take this up and prepare a fresh, focused PR for #203
I’ll keep the change small, with tests + migration note included.