title: OAuth works with Authorization data in the header but not in the URL
body: <p>I'm trying to use Google's OAuth in my system. I've successfully integrated Twitter and LinkedIn but i'm having hard times with Google.</p>
  
  <p>I already have the consumer key, consumer secret and a valid access token. Using the G's OAuth playground I make a call to a protected resource (https://mail.google.com/mail/feed/atom). I've generated the token using this scope.</p>
  
  <p>Using the authorization data in the HTTP header:</p>
  
  <pre><code>GET /mail/feed/atom HTTP/1.1
  Host: mail.google.com
  Accept: */*
  Authorization: OAuth oauth_version="1.0", oauth_nonce="nounce", oauth_timestamp="1314727855", oauth_consumer_key="myconsumerkey", oauth_token="myvalidtoken", oauth_signature_method="HMAC-SHA1", oauth_signature="signature"
  Content-Type: application/atom+xml
  GData-Version: 2.0
  </code></pre>
  
  <p>The response I get from this is a valid HTTP call:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Content-Type: text/xml; charset=UTF-8
  Set-Cookie: S=gmail=yp_A23KtGOD9:gmproxy=PxCjSERnJWBbe; Path=/mail; Secure
  Date: Tue, 30 Aug 2011 18:10:55 GMT
  Expires: Tue, 30 Aug 2011 18:10:55 GMT
  Cache-Control: private, max-age=0
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  Content-Length: 353
  Server: GSE
  &lt;XML response here&gt;
  </code></pre>
  
  <p>But, (and here comes the error), using the same access token but sending it in the URL as param (https://mail.google.com/mail/feed/atom?<strong>oauth_token=myvalidtoken</strong>):</p>
  
  <pre><code>GET /mail/feed/atom?oauth_version=1.0&amp;oauth_nonce=nonce&amp;oauth_timestamp=1314729533&amp;oauth_consumer_key=myconsumerkey&amp;access_token=myvalidtoken&amp;oauth_token=oauthtoken&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_signature=signature HTTP/1.1
  Host: mail.google.com
  Accept: */*
  Content-Type: application/atom+xml
  GData-Version: 2.0
  </code></pre>
  
  <p>I get an 401 error:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Content-Type: text/html; charset=UTF-8
  WWW-Authenticate: BASIC realm="New mail feed"
  Content-Length: 147
  Date: Tue, 30 Aug 2011 18:38:53 GMT
  Expires: Tue, 30 Aug 2011 18:38:53 GMT
  Cache-Control: private, max-age=0
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  Server: GSE
  &lt;HTML about my 401&gt;
  </code></pre>
  
  <p><strong>EDIT</strong></p>
  
  <p>I saw this example and I tried to use anonymous as consumer key and consumer secret. Now it works... but I need to show to the user the project's name declared in the Google's app registration page. I think i'm not using the correct consumer key and consumer secret.</p>
  
  <p>Any clues on this will be appreciated. :)
  Thanks in advance</p>