Clarify that the Authorization header is preferred

specification/client_server_api.rst

@@ -207,6 +207,11 @@ support:
 1. Via a query string parameter, ``access_token=TheTokenHere``.
 #. Via a request header, ``Authorization: Bearer TheTokenHere``.
 
+Clients are encouraged to use the ``Authorization`` header where possible
+to prevent the access token being leaked in access/HTTP logs. The query
+string should only be used in cases where the ``Authorization`` header is
+unaccessible for the client.
+
 When credentials are required but missing or invalid, the HTTP call will
 return with a status of 401 and the error code, ``M_MISSING_TOKEN`` or
 ``M_UNKNOWN_TOKEN`` respectively.