Disable access_token in body and query string

[victordidenko]

I've checked and looks like no one reading and responding issues lately, but I'll create one nonetheless.

According to RFC6750:

2.2. Form-Encoded Body Parameter

...
Resource servers MAY support this method.
...

2.3. URI Query Parameter

...
Resource servers MAY support this method.
...

I want explicitly forbid query string support, but for now it is impossible.
I think it should be configurable, either support body and/or query or not.