OAuth can also add stuff to the URI rather than the body