Don't expose your tokens on the web
Add diagnostics for java oauth handling