More changes to access tokens to allow their use in less trusted environments, and removal of insistance on HTTP Method, so an access token now grants permission to HEAD, GET, OPTIONS, but never PUT or POST