If it should never be called in non-OAuth cases, then this should croak/die/confess/whatever. Don't return success if you are called unexpectedly.