Change how credentials are sent when requesting tokens

The preferred way to send the credentials is through the Authorization
header, ase documented on the Spotify Developer Site
(see https://developer.spotify.com/web-api/authorization-guide/#authorization_code_flow)