Authentication without URIs

Currently we match the PHP API behavior that expects API keys to be encoded in the URI of the requests. We instead want to use an authorization header: https://fastapi.tiangolo.com/reference/security/