Security Issue: Send authorization via header instead of parameter

All OAuth2 provider should accept the authorization via header.  The parameter is optional. 

"Clients SHOULD make authenticated requests with a bearer token using the Authorization request header field with the Bearer HTTP authorization scheme. Resource servers MUST support this method."
http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#authz-header )

It is also a huge security issue to send the access token via parameters, because all logs will store the full url with paramters.