That makes sense. How about just `Oauth._pendingCredentials`? (Shorter, and it is in fact credentials that we are storing.)