Add authorization header to simple set as well as suggest its usage

[oneturkmen]

PR relates to issue #91.

[oneturkmen]

Any update?

[oneturkmen]

@darrelmiller just updated the changes. I think it should be good now.

By the way, when writing this guidelines, what web resources did you use?

[darrelmiller]

Thanks for the update. I wasn't involved when the original guidelines were being written but I'm guessing that many different sources were used to derive these guidelines.

[garethj-msft]

Thanks both. We seem to have lost in the shuffle that if you HAVE to pass the token in the URL due to your perf requirement, then the way to do it MUST be to use the "access_token" query parameter, which seems to be encoded in the initial intent of the paragraph. or am I missing something.

[darrelmiller]

@garethj-msft You are correct, we dropped that. I guess I read what I expected to read. I didn't expect the guidelines to enforce a query parameter name. I see the value in doing that, but my gut is telling me that's a bad idea. I need to think about that some more.

But regardless, the existing guidance says it MUST be "access_token" so we shouldn't change that in this PR.