Having looked at @Coenego's stuff, I've been thinking of moving all this into `oae-oauth`.

That module could take care of providing an authentication strategy, but could also do things like cache/refresh access tokens for other modules (like OrcId or Mediacore)