The matrix spec has supported auth via the Authorization header since r0.3.0, and indeed the use of the query param has been deprecated since v1.11.
Nevertheless the js-sdk still allows applications to fall back to use of the query param by setting ICreateClientOpts.useAuthorizationHeader: false.
I believe we should completely remove this option in the next major version of the SDK.