Update OAuth2 access_token response

Just putsing around with the API for a d3 demo, and it looks like the response is actually sent as an encoded hash parameter instead of a querystring parameter when following the client-side app OAuth2 flow.

Not sure if this was by design (seems likely) or a mistake.