Breaking change for default auth being changed to Basic Auth not clear enough about oauth2-rs

[ramosbugs]

Thanks for the feedback! Apologies that this change caused a hassle for you. An upgrade guide sounds like a great idea. For the latter suggestion, returning the response body as a string makes it hard to deal with responses that fail to decode as valid UTF-8, so I'd prefer to leave it to client applications to decide how to deal with that situation. A string also makes it slightly more likely that client applications will end up logging the malformed response body, which may include sensitive secrets.

I'm traveling for the next two weeks, but I'll take a closer look at this issue when I get back!

[ramosbugs]

It looks like the auth schemes change was documented in the changelog for https://github.com/ramosbugs/oauth2-rs/releases/tag/2.0.0-alpha.1, but I still agree that a single upgrade guide would be useful to save people time.