I am not crazy about it either, actually. This may be a phantom concern but a hash lookup/delete and boolean check should be much faster than comparing strings. Since this method will be called 4-5 orders of magnitude more with the full credentials than with just a bearer_token_request, I suspect that speed difference might matter.

If you don't think if does, I'd be happy to add the check as you suggest.