_GET -> _REQUEST

I do not see why it should only accept token from
query but not from whole request. I want to
pass the token in POST data.