callback_phase is almost there. I just need to create a AccessToken class and lock the error/security handling down