Revert "Try getting token from headers more directly, use locals for route blocking"

Revert "Try getting token from headers more directly, use locals for route blocking" #95