in a access-rule that accepts both

cookie_session

and

oauth2_client_credentials

. in the authorizer, how would you identify that the request came with oauth? I see the

.Extra

is empty for oauth-client calls, but can I rely on that?