added async locking to OAuthBearerHandler