Default to making the OAuth login by token URLs unexposed.
Merge pull request #4 from flebel/master

Unexpose the OAuth login by token URLs by default.