When I add the required app code and app secret for the 0auth2/token curl, should it be placed in the http header, or in the curlopt_postfields setopt? If it goes in the http header, should it be a seperate item in the array, or in my json encoded array with the other 3 parameters?