app.js

var access_token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsI...'; //saved from previous step
var xhr = Titanium.Network.createHTTPClient();
xhr.setTimeout(30000);
xhr.onload=function() {
    Ti.API.info('Protected Resource: '+this.responseText);
};
xhr.onerror= function() {
    Ti.API.info('Error response: '+this.responseText);
};
xhr.open('GET', 'https://my_resource_auth_server.azure-mobile.net/api/auth');
xhr.setRequestHeader("Content-Type", "application/json");
xhr.setRequestHeader("Accept", "application/json");
xhr.setRequestHeader("X-ZUMO-AUTH", access_token); // this is the magic line
xhr.send();