github provider should use Authorization header instead

[alee]

GitHub is deprecating their query parameter access token based authentication in favor of setting an Authorization: header in the request. I think this should be a fairly simple change to the GitHub provider and adding the header to the requests.get() call. Happy to submit a PR for this but I'm not sure if there's anything else needed..

https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters

[peterbe]

I suspect that

django-allauth/allauth/socialaccount/providers/github/views.py

Line 30 in 5b9b855

resp = requests.get(self.profile_url, params=params)

and

django-allauth/allauth/socialaccount/providers/github/views.py

Line 42 in 5b9b855

resp = requests.get(self.emails_url, params=params)

need to change to something else.
What I can't see (and I've never actually worked on this code) is that we're not even using any form of authentication when we do those requests.get(...) calls.

[alee]

I did a little more spelunking and it looks like authentication happens in the OAuth2LoginView but we shouldn't have to deal with that since the rest of the oauth2 flow remains unchanged, GitHub is just changing how it handles api requests via the oauth2 access token.

Looking at other providers that also set the Authorization header I think it is as simple as setting

headers={'Authorization': 'token ' + token.token}) in the followup GET requests for the email and profile info. I've opened a PR: #2458