Security Issue: API Keys should not be transmitted in url

[dannybucks]

Describe the bug

I saw that the API Keys are passed as url parameter in the form &token=XXX. However, this is a security issue as the url can stay in logs and even be exploited by attackers, see here:
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url#

Instead the token should be passed via the http headers, this option even exists in the rest api:
https://developers.arcgis.com/documentation/security-and-authentication/reference/http-authorization-headers/

In my opinion, this is quite a security issue that should be fixed..

Reproduction

Just in case I'm doing something weired, here is my code (typescript):

esri
      .dynamicMapLayer({
        url: layer.url,
        f: 'image',
        token: layer.useToken ? token : undefined,
      })
      .addTo(map as never);

This leads to api calls like this:
/MapServer/export?bbox=828042.3274133145%2C5934521.908589838%2C829250.9879230738%2C5933452.984522413&size=1012%2C895&dpi=96&format=png32&transparent=true&bboxSR=3857&imageSR=3857**&token=xxx**&f=image

Logs

System Info

Leaflet Version: 1.8.0, Esri Leaflet Version: 3.0.14

Additional Information

No response

[jgravois]

see #1364