reuse oauth tokens across app restart

for the tokens to remain valid, the app secret needs to be the same :/
Also consistently using the same terminology now.