Agreed. The token should be used only after the user is authenticated through another channel (e.g., username+password). Otherwise, an attacker could obtain th

Agreed. The token should be used only after the user is authenticated through another channel (e.g., username+password). Otherwise, an attacker could obtain the target's OAuth token by getting the target to provide the token to a malicious application. The attacker can then easily authenticate through your library.