put OAuth token setter and OAuth token state setter into locking mechani...

...sms.
The logic shouldn't be called by other classes thus private/protected. Using protected is more about extended class calling this method rather than overriding.