Several improvments to do:

• Support the classic "Authorization: Bearer XXX" pattern
• When token is present in a get parameter, find a way to redirect to the same URL without token after authentication, for security concerns
• When token is present, we should first invalidate any existing session and authenticate with the token. We'll have to chose whether we invalidate existing session even with invalid token incoming.