improved Request->isApi() to recognize OAuth access tokens