[andrewmccall]

OAuth2 isn't just about bearer tokens and while the OAuth2 spec doesn't mandate using TLS the bearer token sub-spec does.