Appservice API requires access_token to be in the query parameters

[Half-Shot]

It's generally agreed upon that headers are a better place for tokens, to reduce accidental publishing of tokens in the logs. It would be nicer to support headers instead of insecure query parameters, but would require bridges and homeservers to both start using the new header.

Perhaps the best approach is for homeservers to start publishing it in both places, and deprecate query parameters. Once enough time has passed, we could drop query parameters entirely.

Unfortunately this does get into the weeds of versioning, as this would be a globally breaking change.

[richvdh]

Duplicate of #679