put OAuth token setter and OAuth token state setter into locking mechani...

...sms.
"Using protected is more about extended class calling this method rather than overriding."

In that case, maybe it should be a final method?