The `oauth` module no longer appends `type=web_server` to data access
request bodies.
WIP allow postmessage