docs(auth): document ?token= query parameter as alternative to Authorization header