Why isn't this logic in `OAuth2\Request` instead?