Add shindig security token to makeRequest header

Following on in the same vein as SHINDIG-1756, we want to better identify the source of the requests coming into the server via makeRequest. If the request authz is not none, then the security token flows. if the authz is NONE, the security token is not sent. This change would be to include the security token on every request. Since including the token on the URL parameter would break the ability to cache, the security token will instead be added as a header named X-Shindig-ST on all requests. On the shindig server side, the header will be processed if there is not already a token supplied as a url parameter or oauth related parameter.