The comments above

//if you want to use three-legged OAuth, always pass OAuth key to the key argument

no longer matches the new bahavior and this piece of code in Cocoafish()
this.useThreeLegged = function(isThreeLegged) {
       threeLegged = isThreeLegged;
       if(!this.oauthKey) //If three-legged OAuth is used the passed in 'key' should be OAuth key
           this.oauthKey = this.appKey;
   };