Update OAuth2 access_token response

Just putsing around with the API for a d3 demo, and it looks like the response is actually sent as an encoded hash parameter instead of a querystring parameter.