Question: how would you persist access tokens about oauth2-server-php

[F21]

This is basically what I was wondering in #42. I have looked at the spec, but it does not give us any guidance as to the correct behaviour so the current behaviour should be "fine", I think.

Having said that, if we were to copy Facebook's implementation, we should probably do this:

• If the existing token has not expired, return it.
• If a new token is needed, delete the old token in the storage.

[ccazette]

hehe.. indeed that's the very same question :)

Closing this in favor of #42.

[bshaffer]

Yes, see the issue above for an update on this. The spec does seem to ignore this question, and implies multiple valid tokens for the same user/scope can exist at the same time. I agree that this is silly, so I think we should just make the default behavior mimic facebook, and let the library be configurable