as per https://dev.twitter.com/discussions/16443
since begining of April 2013, the getAccessToken should always pass the oauth_verifier. To force the use of the API to pass it, make the getAccessToken $oauth_parameter mandatory.

All uses of twitteroauth::getAccessToken should pass $_REQUEST['oauth_verifier'] i.e.
$TwitterOAuth->getAccessToken($_REQUEST['oauth_verifier'])
Merge pull request #178 from jeroenbaas/master

oauth_verifier is now required for getAccessToken