Oath always in the Authorization header

Oauth should always be done in the Authorization header
not in params for unsigned gets