Access tokens are stored in the session. OAuthAuthorizationCodeClient contains the Authorization Server callback.