OAuth Tokens need to be able to keep the end-user name used to authorize the client request

Glen helped to identify a limitation to do with OAuth tokens not being able to provide a hint re which end user authorized a client request. This makes it tricky to avoid writing OAuth apps where the end user does not wish to share the same login name between third-party services and resource servers