How hard is it to add in access_token validation protocol that provides them?

Ah, this is from 2012.

Part 2: http://hueniverse.com/2012/07/30/on-leaving-oauth/

A response: http://www.tbray.org/ongoing/When/201x/2012/07/28/Oauth2-dea...

Original title is "OAuth 2.0 and the Road to Hell" which provides more context