Wonder if it’s an nginx thing and it’s stripping the header out.
Before if (!empty($username)) { in html/includes/api_functions.inc.php add this:
print_r($username);
print_r($token);
print_r($app->request->headers->get('X-Auth-Token'));
exit;
Re-run the api call and see what’s output.