Keep the auth in the querystring, and PUT the JSON-formatted change to the appropriate endpoint. eg (PHP):
To set target temperature:
$ch = curl_init("https://developer-api.nest.com/devices/thermostats/$THERMOSTAT_ID?auth=$AUTH");
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PUT");
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"target_temperature_c": 21.5}');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
echo curl_exec($ch);
To set Away mode:
$ch = curl_init("https://developer-api.nest.com/structures/$STRUCTURE_ID?auth=$AUTH");
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PUT");
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"away":"away"}');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
echo curl_exec($ch);