token-access: allow token in headers not only in GET/URL

rhodecode/lib/base.py

@@ -469,7 +469,14 b' def get_auth_user(request):'
     ip_addr = get_ip_addr(environ)
 
     # make sure that we update permissions each time we call controller
-    _auth_token = (request.GET.get('auth_token', '') or request.GET.get('api_key', ''))
+    _auth_token = (
+            # ?auth_token=XXX
+            request.GET.get('auth_token', '')
+            # ?api_key=XXX !LEGACY
+            or request.GET.get('api_key', '')
+            # or headers....
+            or request.headers.get('X-Rc-Auth-Token', '')
+    )
     if not _auth_token and request.matchdict:
         url_auth_token = request.matchdict.get('_auth_token')
         _auth_token = url_auth_token

rhodecode/tweens.py

@@ -119,3 +119,4 b' def includeme(config):'
 
     # This needs to be the LAST item
     config.add_tween('rhodecode.lib.middleware.request_wrapper.RequestWrapperTween')
+    log.debug('configured all tweens')