Better error message
Hook should return a user, so return it as well as log a user on
Check that application still exists on token validation (if you delete your application, you invalidate all tokens)
Updating readme to cover why you might want to use OAuth2 authentication over native HTTP signed header