include oauth_verifier as a header, not a parameter

Per [RFC 5849](http://tools.ietf.org/html/rfc5849), the POST request for
the access token should not include a body, but instead include the
verifier as part of the "Authorization: OAuth" header.  The current code
is broken for authentication against servers which verify the body of
the POST request (in particular, Fitbit has recently switched to this
verification).
Merge branch 'oauth_verifier_fix' of https://github.com/paulswartz/meteor into paulswartz-oauth_verifier_fix
Merge branch 'paulswartz-oauth_verifier_fix' into devel