To get the chromoting host list, pass the OAuth access token as a URL parameter,

remoting/webapp/host_list.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * Class representing the host-list portion of the home screen UI.
  */
 
 'use strict';
@@ skipping 73 matching lines @@
  */
 remoting.HostList.prototype.refresh = function(onDone) {
   /** @type {remoting.HostList} */
   var that = this;
   /** @param {XMLHttpRequest} xhr The response from the server. */
   var parseHostListResponse = function(xhr) {
     that.parseHostListResponse_(xhr, onDone);
   }
   /** @param {string} token The OAuth2 token. */
   var getHosts = function(token) {
-    var headers = { 'Authorization': 'OAuth ' + token };
+    // TODO(simonmorris): Pass the access token in a header, not a URL
+    // parameter, when crbug.com/116574 has a better fix.
+    var params = { 'access_token': token };
     remoting.xhr.get(
         'https://www.googleapis.com/chromoting/v1/@me/hosts',
-        parseHostListResponse, '', headers);
+        parseHostListResponse, params);
   };
   remoting.oauth2.callWithToken(getHosts);
 };
 
 /**
  * Handle the results of the host list request.  A success response will
  * include a JSON-encoded list of host descriptions, which we display if we're
  * able to successfully parse it.
  *
  * @param {XMLHttpRequest} xhr The XHR object for the host list request.
@@ skipping 155 matching lines @@
  */
 remoting.HostList.COLLAPSED_ = 'collapsed';
 
 /**
  * Key name under which Me2Me hosts are cached.
  */
 remoting.HostList.HOSTS_KEY = 'me2me-cached-hosts';
 
 /** @type {remoting.HostList} */
 remoting.hostList = null;