Allow access token in body when not GET

Previously it was enforced that the request must be POST however
the spec only stipulates the method should not be GET.
Fixes #4