Support for OAuth2 Token in Query String / POST Body

- Bearer token can be passed in the query string as 'access_token'
- Bearer token can be passed in a POST body as 'access_token'
- Added tests for all 3 oauth cases.
- Form-Encoded *should* work with PUT, but does not (and the
  underlying oauth server restricts to POST as well).