put OAuth token setter and OAuth token state setter into locking mechani...

...sms.
Why was this made protected?