I believe you are referencing known issues, it was previously fixed but seems to have came back.
Currently Known Kraken API Issues
As per Authenticated API Requests - Placing the OAuth in the URL is acceptable. The incorrect output is just a bug.
When an API request requires authentication, you can send the access token you obtained above in any of the following ways:
Send token as header:
curl -H “Authorization: OAuth [access token]” https://api.twitch.tv/kraken/
Send token as URL parameter:
curl https://api.twitch.tv/kraken?oauth_token=[access token]
Send token in the HTTP body (cannot be used with GET and DELETE methods)
curl -d ‘oauth_token=[access token]’ https://api.twitch.tv/kraken/channels/cevtest15/commercial