Use header instead of url parameter

Sources/App/routes.swift

@@ -4,7 +4,9 @@ import Vapor
 private let decoder = JSONDecoder()
 
 private func authorize(_ request: Request) throws {
-    let key = try request.query.get(String.self, at: "key")
+    guard let key = request.headers.first(name: "key") else {
+        throw Abort(.badRequest)
+    }
     guard server.hasAuthorization(for: key) else {
         throw Abort(.forbidden)
     }