Removed readObject and writeObject from OAuth2Request (which no longer needs them)
Make shared fields private with protected setter