Wordpress resource owner requires access token to be sent as header when calling API

Replaces #489. Fixes #479.