Send Upload Token via Header (#439)

* Send token via HTTP header vs. URL param

* Revert testing change

* Update script to use token in header

* update SHASUM

* maybe fix tests?

* Undo accidental deletion

* More test fixes

* fix build

SHA1SUM

@@ -1,2 +1,2 @@
-69d5c7bb51834888b0ce0aed1f3d6b9dcdb4b474  codecov
+ae30de7e8b98fb5f0cddce64771c53c3613a8ae2  codecov
 8b75c056bddd46e8dbfaa475935fbba6f6a33c77  env

SHA256SUM

@@ -1,2 +1,2 @@
-cd0d8f13721c3062c1dac41001b5a9c047f4320bdfc859fa6995259581fa67d3  codecov
+af719f83d08be837ebeba214729e5b76dbe0b1d073de1efc4e2cd5d73c8da7c2  codecov
 8d0fa7c26d1e95f361b054649a1ad6afe5e2a1a0f128289149c7227e15eefc28  env

SHA512SUM

@@ -1,2 +1,2 @@
-a5684ac5f59e2e71df694a19dbd5cb926ca5edf3cde1bd247e588c3ad16be2e051453617e41417a56b83aa4ee7cf8249832648102c9def7a173edb4fabc8d432  codecov
+4de731fb90c196025daca480182adc080bb53ae24a5e634734810887515377ce33ed9b7ef4729013aa33fc7c6bbce76c8d248d1bd6e894be24368111cee6ee56  codecov
 47689572d9bcf89be411a63129a5eb95257558b5d8df6ae96a973bde6c954e9bc943f6a87c2884440abc831637b967f2da748564ff0f61d99dcf9b0a1447d1df  env

codecov

@@ -1783,7 +1783,7 @@ if [ "$dump" != "0" ];
 then
   # trim whitespace from query
   say "    ${e}->${x} Dumping upload file (no upload)"
-  echo "$url/upload/v4?$(echo "package=$package-$VERSION&token=$token&$query" | tr -d ' ')"
+  echo "$url/upload/v4?$(echo "package=$package-$VERSION&$query" | tr -d ' ')"
   cat "$upload_file"
 else
   if [ "$save_to" != "" ];
@@ -1802,21 +1802,20 @@ else
   say "    ${e}url:${x} $url"
   say "    ${e}query:${x} $query"
 
-  # Full query without token (to display on terminal output)
-  queryNoToken=$(echo "package=$package-$VERSION&token=secret&$query" | tr -d ' ')
-  # now add token to query
-  query=$(echo "package=$package-$VERSION&token=$token&$query" | tr -d ' ')
+  # Full query (to display on terminal output)
+  query=$(echo "package=$package-$VERSION&$query" | tr -d ' ')
 
   if [ "$ft_s3" = "1" ];
   then
     say "${e}->${x}  Pinging Codecov"
-    say "$url/upload/v4?$queryNoToken"
+    say "$url/upload/v4?$query"
     # shellcheck disable=SC2086,2090
     res=$(curl $curl_s -X POST $cacert \
           --retry 5 --retry-delay 2 --connect-timeout 2 \
           -H 'X-Reduced-Redundancy: false' \
           -H 'X-Content-Type: application/x-gzip' \
           -H 'Content-Length: 0' \
+          -H "X-Upload-Token: ${token}" \
           --write-out "\n%{response_code}\n" \
           $curlargs \
           "$url/upload/v4?$query" || true)
@@ -1863,6 +1862,7 @@ else
         -H 'Content-Type: text/plain' \
         -H 'Content-Encoding: gzip' \
         -H 'X-Content-Encoding: gzip' \
+        -H "X-Upload-Token: ${token}" \
         -H 'Accept: text/plain' \
         $curlargs \
         "$url/upload/v2?$query&attempt=$i" || echo 'HTTP 500')