This kind of "Unless I missed something" comment worries me. Did you follow the spec? I'm not versed in OAuth, so I am not sure if you are missing something here. If you've covered the implementation basis, please remove that last sentence.