Document access_token in headers

[t3chguy]

No description provided.

[richvdh]

You can now (as of matrix-org/synapse#1098) put your access token in an Auth header instead. We should spec it.

[richvdh]

I don't really feel this is adequately documented yet. It's nice to have it mentioned in the spec but we need to be clearer about how clients use it, and that servers must provide it.

[turt2live]

@richvdh the section feels fairly clear to me - what kind of improvement were you thinking of?

for reference:

Most API endpoints require the user to identify themselves by presenting
previously obtained credentials in the form of an access_token query
parameter or through an Authorization Header of Bearer $access_token.
An access token is typically obtained via the Login_ or Registration_ processes.