Major Description
In OAuthFetcher the storage key to save an access token that has been fetched for an proxied requests that is secured through OAuth includes the current owner id. This means that this access token will be accessable for all viewers visiting the gadget instance of this owner and could possible use this access token to make operations at the target API in behalf of the owner.
To prevent it the storage key should include the viewer id instead.