auth_code: default to header based authorization

http://tools.ietf.org/html/rfc6749#section-2.3.1

> Including the client credentials in the request-body using the two
   parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
   to directly utilize the HTTP Basic authentication scheme (or other
   password-based HTTP authentication schemes).  The parameters can only
   be transmitted in the request-body and MUST NOT be included in the
   request URI.
You also gotta URL encode the `client_id` and `client_secret` before joining with `:`

http://tools.ietf.org/html/rfc6749#section-2.3.1