Stop leaking access tokens

Also snarky-but-true notes inre OAuth2