Removed authorization flow and all associations entirely. This is not done by signing stuff with HMAC-SHA1 and absolutely independent of passwords, i understood finally the OAuth1.a specs refer to this as 'custom'. Authorization is done in application level, not this lib. level.