Maybe we should have request_token take params as a parameter instead.  It could then validate them, extract the code, make the request, then return the token.  If we wanted to support legacy auth, we could just have it just compute the password without making a request.