OAuth2Authenticator: protected fields