intridea/oauth2 — pull request #178 by jcromartie (2014-05-21 16:31:10+00:00)
Title: Omit extra params when Authorization header is present

The OAuth 2 spec states that a token request with extra parameters or multiple methods of authorizing the client (e.g. both an "Authorization: Basic" header and client_id and client_secret params) should be treated as an invalid_request error.