feat: private access token support

[nover]

This PR supersedes #93 by incorporating the changes, but as a non breaking change as originally proposed on the PR.

Commit dfcd93f31a11af6769b2adf1cc4b8586f19b982b from @alexcrowdpharm has been cherry-picked from the fork, and I've updated the code-paths to retain support for the legacy hapikey for now.

[alexcrowdpharm]

Thanks for your follow up on this! One thing additional which may not quite be in scope: Using Bearer authorization doesn't necessarily require a token that begins with "pat-". For example, when using the OAuth flow in public apps, the access token value passed into the bearer header will change upon token refresh (and won't be a "pat-" value).

[nover]

Thanks for your follow up on this! One thing additional which may not quite be in scope: Using Bearer authorization doesn't necessarily require a token that begins with "pat-". For example, when using the OAuth flow in public apps, the access token value passed into the bearer header will change upon token refresh (and won't be a "pat-" value).

Thanks for this little bit 👌
I guess we can actually go about removing the support for the legacy auth system all together now, since it went out of support back in December.