include oauth_verifier as a header, not a parameter

Per [RFC 5849](http://tools.ietf.org/html/rfc5849), the POST request for
the access token should not include a body, but instead include the
verifier as part of the "Authorization: OAuth" header.  The current code
is broken for authentication against servers which verify the body of
the POST request (in particular, Fitbit has recently switched to this
verification).