Wouldn't the word `oauth` suggest that it is only valid if it has a valid access_token and refresh_token?