Use the Authorization request header field to send tokens instead of the URI query string.

Per http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-14#section-2.1
this is the recommended approach which must be supported by all servers.