I think we should probably be using the ``oauth_token`` from the consumer here to validate that it's empty and remove the unused empty server side token initialization ``token = oauth.Token(key='', secret='')``