ok, it helps if you validate the auth token at the proper point of the oauth flow