I've gone through the spec again and I think we're actually not deviating at all. It's probably just not very common.

From the [spec@1.3.4](http://tools.ietf.org/html/rfc6749#section-1.3.4)
>   The client credentials (or other forms of client authentication) can
>   be used as an authorization grant when the authorization scope is
>   limited to the protected resources under the control of the client,
>   or to protected resources previously arranged with the authorization
>   server.  Client credentials are used as an authorization grant
>   typically when the client is acting on its own behalf **(the client is
>   also the resource owner)** or is requesting access to protected
>   resources based on an authorization previously arranged with the
>   authorization server.

Originally, I thought that a "client" could be authenticated on it's own and perform actions on the API that were not tied to a user. This made little sense to me. That's why I added that "OAE Warning".

Re-reading that spec passage makes me more confident that what we're doing is actually legit. The bit in bold is exactly what we're doing.

I'll remove the  comment from the code.