The OAuth plugin currently does not support token refresh, as described in the OAuth specification. This is needed to allow Android clients (among others) to refresh their tokens as they expire. It appears there was some planning for this, as a refresh_token field exists in the OAuthToken model, but it is currently unpopulated.

This work may overlap with work on #517.

Users can currently authorize an application and view the applications they've authorized, but can not revoke access. We should add support for this.

1: Our Lost password function reveals if a user name or

an email address is registered, which can be considered a data leak. Should we simply respond and say: "If you have an account here, we have send you your email"?

2: username and email search is case sensitive. Is that

intended? Should we provide helper functions or how do we deal with that?