oauth2 access token only goes in headers, not query string
add support for inbox messages
add support for liking messages