Web.Api: Authenticate with the Authorization header by default. Sending OAuth authorization information via query variables has been deprecated by RFC6750 (and others), and some endpoints (eg GitHub) do no longer support the old method. Switch to using Authorization: Bearer <access_token> by default. Also updates Web.Api.Github accordingly.