Feature request: Additional response-data-transport options
Hi there,

Thanks for the library. I successfully use it for one of my projects. 

Do you have any plans for `transport`? According https://github.com/simov/grant#response-data-transport we have two options: `querystring` and `session`. We used `querystring` by default and security check showed that to be more secure we shouldn't put sensitive data in URL. In the project, we use token-based authentication. Now we also have sessions but would like to rid of it.

For example, the additional option can be a `header`. Have any chance that this feature will be considered? Thanks in advance.