Update book text to discuss auth token in header

[jessieay]

• Add section about auth token in header
• use owner id instead of device token in json response
• Use set_headers helper method for specs

[dazmuda]

I think you should go ahead and merge this ahead of my section. I appreciate the link to stack overflow since it provides a bit of opinion/context.