I don't think the difference will be that big internally. With two top-level classes the decorators work differently based on what __class__ they are decorating. With AuthorizationExtension the decorators will work differently based on a flag or (property decorated?) function. 

So I think the best option is to go with a single object in AuthorizationExtension, this will be easiest for users, make oauth more like the known login rather than a major change in usage and I think produce clearer and simpler programs than the alternative.