Well I can say it /doesn't/ break the example providers we use, but I'm sure that despite the spec indicating the providers have to support bearer tokens in this way, they undoubtedly may not in some cases. However given that the major OAuth 2.0 provider (Facebook) does maybe we can safely set the default without breaking code people wrote last week.