Send GitHub access token as a header, not as a URL parameter

[LearningNerd]

Because throwing the access token right into the URL is terrible for security! Look into how to access headers from client-side JavaScript. (Surely that must be possible!)