SAL Server should extract token from query with "access_token" keyword

[TOFarmer]

Description

_extract_token_query checks for the token using the 'token' keyword. The OAuth 2.0 Authorization Framework: Bearer Token Usage requires the token to be passed in a query with the keyword 'access_token'.

Suggested fix

To allow for backwards compatibility, the token should be extracted with either 'access_token' or 'token', with the former taking precedence.

[TOFarmer]

Set as Priority 1 as the SAL client only implements tokens in headers and there is low expectation that users will use their own access methods for accessing a SAL server.