@stloyd I could change this by renaming the new instatiated $token to $new_token but that seems even worse:

```php
$new_token = new OAuthToken($token->getAccessToken(), $user->getRoles());
$new_token->setRefreshToken($refreshToken);
$new_token->setExpiresIn($expiresIn);
...
return $new_token;
```

Do you know where the need to instantiate a new OAuthToken comes from? The $token passed to the `authenticate` method is already an instance of `OAuthToken` so there should be no need to instantiate a new `OAuthToken`. Or am I missing something?