use HTTP Authorization header for OAuth instead of a URL paramter where possible