APP with OAuth may require using the header method... eww... (doesn't specify auth type, but doesn't URL-encode POST fields)