always returns true for RequestToken#oob?