Allow ability to restrict oauth params to Authorization header only