Since it seems Instagram also accepts passing access_token as a query (i.e. `?access_token=...`), I would prefer to use it instead.

But I could also understand maybe you need one or the other in some cases, for example, you might not want to see the access_token in the URL in some places or something like that. What do you think? Do we really need to support both? If we do, how to let people select if (s)he wants to use headers or queries?

I would first merge https://github.com/godfat/rest-core/pull/5 accordingly, and continue to work on this. At that point I would try to get an Instagram account to try it.