serializable Auth Token
add AccessTokenExpire to default domain (+docs)
always use redirect_uri when possible