seems like this should default to `True`.  RFC 6750 [section 2.1](http://tools.ietf.org/html/rfc6750.html#section-2.1) says that the Bearer Authorization field must be supported.  The form encoded and URL parameters [are discouraged](http://tools.ietf.org/html/rfc6750.html#section-2.3).