FIX: oauth token endpoint action should be POST