If you are passing authorisation token via http headers then you need to have a client side logic to pass this to server every time you make a request. A skimmer can look for this in your client side code and can hijack your user session with Java script.
But if the same info is passed via cookies then it is the browsers responsibility to pass the cookie whenever a request is made(you are freed of writing client side logic). So making it a bit difficult(but not impossible) to identify the mechanism in which the token is being passed.
But the hacker should be able to sniff the network to get to this info.
So in conclusion a cookie is definitely safer.
If you are so concerned about security then go for SSL certificates which almost removes the threat of network sniffing a futile activity.