Reverting this for now, as I'm pretty sure it's either access_token in query string OR access_token in header, both are not mandated by Doorkeeper
Added overview of file upload process