Conform to Authorization header standards.

[aarona]

Currently, tokens are sent through custom headers access-token: <jwt token> and refresh-token: <jwt token>. It would be better if they were sent using Authorization: bearer <jwt token>