Add access_token to oauth middleware

In latest oauth2 spec versions oauth_token was replaced with
access_token
Update CHANGELOG