Use the `Authorization` header instead of request body parameter (`api_key`)

[willdurand]

Instead of using a request body parameter to read the api key, we should use the Authorization header.