Rewrite WebClient.oauth_access()

[pastelmind]

The oauth.access method, according to official documentation, accepts a temporary OAuth code and returns an API access token (xoxp-XXXXXXX...). This means that it does NOT require an Authorization: Bearer xxx header--in fact, this is impossible for an app that is being installed, as it does not have a token yet.

Thus, it makes no sense for WebClient.oauth_access() to be a normal instance method of WebClient, which requires an API token for instantiation. I suggest that it be moved to a @staticmethod or @classmethod, depending on its implementation.

Also, the current implementation sends the client ID and secret as POST parameters in the request body, even though the official document says:

We strongly recommend supplying the Client ID and Client Secret using the HTTP Basic authentication scheme, as discussed in RFC 6749.

Thus, this method needs to be rewritten to NOT use WebClient.api_call(), but manually send a request using HTTP Basic Authentication instead.

[RodneyU215]

Thanks @pastelmind for reporting this error! I'm jumping on this and will get it resolved.

[RodneyU215]

This is fixed and released as of 2.2.1.