PayPal PHP Sandbox Header Auth？

I am currently facing some problems during my paypal refund test.

I get the token of the account by making this:

 public function __construct(){
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://api.sandbox.paypal.com/v1/oauth2/token");
    curl_setopt($ch, CURLOPT_HEADER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
    curl_setopt($ch, CURLOPT_USERPWD, $this->clientID.":".$this->secret);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "grant_type=client_credentials");

    $result = curl_exec($ch);
    $json = json_decode($result);

    $this->auth = $json->access_token;

   // echo "Auth?" . $this->auth;

 }

And when i try refund a sale, it just returns 1 nomatter what. The transaction ID is correct, but it's like it doesn't set the right headers - can someone help me?

 public function RefundSale($transaction_id){
     $url = self::getPath() . "/payments/sale/".$transaction_id."/refund";
     echo "URL:" . $url;
     self::rest($url);
 }

 public function rest($url,$data=""){

    $ch = curl_init();

    if ( !empty($data)): $data=json_encode($data); endif; //Array to json?

    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    if ( !empty($data)): curl_setopt($ch, CURLOPT_POSTFIELDS, $data); endif;
     curl_setopt($ch, CURLOPT_USERPWD, $this->clientID . ":" . $this->secret);
    $result = curl_exec($ch);

    var_dump($result);
 }

A couple of things

1. You must set curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1) to retrieve curl response. Otherwise you get only a true/false success/error message.
2. After fixing this, the code snippet gives a 400 (bad request) http response code. This is rectified by calling curl_setopt($ch, CURLOPT_POSTFIELDS, $data) unconditionally. Even when you have no data to send, this ends up sending an empty payload.
3. The last issue is with the way you authenticate the call. Once you have obtained an auth token, you authenticated API calls by sending a 'Authentication: Bearer ' header.