intridea/oauth2 — pull request #192 by maletor (2014-09-12 20:16:00+00:00)
Title: auth_code: default to header based authorization

http://tools.ietf.org/html/rfc6749#section-2.3.1

> Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes). The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.