[OAuth2] Send authorization via header instead of parameter

Replaces #526.