using "Microsoft.Owin.Security.OAuth" for DataProtector 

to be compatible with Katana's OAuth-Server.

I think, it's ok to just do the for the data-protector that is used for the access-token, cause the refresh-token and the access-code isn't transparent to the client.