Moved access token to header as the new API expects

[emanuele-albini]

This solves the 403 error returned by the API.

{
    "error":"Invalid CSRF token",
    "error_code":410,
    "error_extra":{"access_type":"web_session","event_id":"private","retry_after":3},
    "error_tag":"AUTH_INVALID_CSRF_TOKEN",
    "http_code":403
}

As per new API documentation the access token must be passed in the header (see https://developer.todoist.com/sync/v9/#authorization)

#106

[jsmith432]

Thanks for these commits, I made these changes manually, and it solved my issue.