put OAuth token setter and OAuth token state setter into locking mechani...

...sms.
I feel like this should be called setOAuthRefreshListener, since it does a replace of the existing listener, not an add.