Decided we didn't need to keep the token secret in the

Oauth_application_user record

classes/Oauth_application_user.php

@@ -14,7 +14,6 @@ class Oauth_application_user extends Memcached_DataObject
     public $application_id;                  // int(4)  primary_key not_null
     public $access_type;                     // tinyint(1)
     public $token;                           // varchar(255)
-    public $secret;                          // varchar(255)
     public $verifier;                        // varchar(255)
     public $created;                         // datetime   not_null
     public $modified;                        // timestamp   not_null default_CURRENT_TIMESTAMP

classes/statusnet.ini

@@ -373,7 +373,6 @@ profile_id = 129
 application_id = 129
 access_type = 17
 token = 2
-secret = 2
 verifier = 2
 created = 142
 modified = 384

db/statusnet.sql

@@ -229,8 +229,7 @@ create table oauth_application_user (
     profile_id integer not null comment 'user of the application' references profile (id),
     application_id integer not null comment 'id of the application' references oauth_application (id),
     access_type tinyint default 0 comment 'access type, bit 1 = read, bit 2 = write, bit 3 = revoked',
-    token varchar(255) comment 'authorization token',
-    secret varchar(255) comment 'token secret',
+    token varchar(255) comment 'request or access token',
     verifier varchar(255) not null comment 'verification code',
     created datetime not null comment 'date this record was created',
     modified timestamp comment 'date this record was modified',