Use something more secure than bearer tokens for auth

moving access_tokens to the http headers mitigated it, but it's still quite easy to leak an access_token, in which case, you lose. Perhaps we should consider using something like OAuth 1 signatures, like twitter: https://developer.twitter.com/en/docs/basics/authentication/guides/creating-a-signature

Start by reviewing the Matrix protocol specification's existing access-token authentication behavior described in this issue, then compare it with the linked OAuth 1 signature approach. The issue does not name files or tests; done would require an agreed, specified replacement for bearer-token authentication.

Written by the indexing model from the issue text.