So it's not so much a problem with OAuth itself, but with the way it was implemented here?