Create a way to manually run getters/setters via Fetch/HTTP using x-api-token

[rglover]

This just came up. Would be helpful to get around the CSRF stuff manually by passing an x-api-token header that can be set in your settings file at something like config.api.token.