What are the thread-safety expectations and what is the lifecycle of the class? E.g. do we create one per request, so that it doesn't need to be thread safe, or do we reuse across multiple acquireToken calls?