Introduce AppState

... to keep OAuth static configuration as well as transactional state