Summary

• Allows single_access_token to be supplied via HTTP request headers in addition to query params
• Disabled by default — to enable, set a non-nil headers_key (e.g. headers_key "user_credentials")
• Uses CGI-compliant header key transformation (HTTP_ prefix, uppercased, hyphens to underscores) to match Rack conventions

This is a continuation of #728, rebased onto current master with all prior review feedback from @jaredbeck and @tiegz addressed, including:

• DRY extraction of shared single_access_token_enabled? and persist_by_single_access_token methods
• Combined params/headers tests into single_access_token_test.rb
• Default headers_key to nil (disabled by default)
• Use controller.request.headers (request headers) instead of controller.headers (response headers)
• CGI-compliant header key transformation

Test plan

• All 229 existing tests pass with 0 failures
• Verify header-based single access token authentication in a Rails app
• Verify feature remains disabled by default when headers_key is not set

🤖 Generated with Claude Code