Migrate admin endpoints from token-in-URL to X-Admin-Token header

sweep.sh

@@ -21,8 +21,11 @@ python3 - "$WEBHOOK_TOKEN" <<'PY'
 import sys, urllib.request, urllib.error
 
 token = sys.argv[1]
-url = f"http://127.0.0.1:8000/admin/sweep/{token}"
-req = urllib.request.Request(url, method="POST", data=b"", headers={"Content-Type": "application/json"})
+url = "http://127.0.0.1:8000/admin/sweep"
+req = urllib.request.Request(url, method="POST", data=b"", headers={
+    "Content-Type": "application/json",
+    "X-Admin-Token": token,
+})
 try:
     with urllib.request.urlopen(req, timeout=60) as resp:
         print("sweep:", resp.read().decode())