Expand bearer authentication to POST/query parameters

This roughs out sections 2.2 and 2.3 of RFC 6750