I'd like to camelCase everything, but the design doc was following Oauth2, which uses snake_case for it's parameters. unless @warner thinks we can break the mold.