Index: lib/oauth.c
===================================================================
--- lib/oauth.c	(revision ee84bdbc2510fa09bd0f67e14d06e69c2626d0f1)
+++ lib/oauth.c	(revision 18dbb20242719f7537ad1a18a9a3befa2eefd502)
@@ -225,4 +225,15 @@
 }
 
+void oauth_info_free( struct oauth_info *info )
+{
+	if( info )
+	{
+		g_free( info->auth_params );
+		g_free( info->request_token );
+		g_free( info->access_token );
+		g_free( info );
+	}
+}
+
 static void oauth_add_default_params( GSList **params )
 {
@@ -286,5 +297,5 @@
 static void oauth_request_token_done( struct http_request *req );
 
-void *oauth_request_token( const char *url, oauth_cb func, void *data )
+struct oauth_info *oauth_request_token( const char *url, oauth_cb func, void *data )
 {
 	struct oauth_info *st = g_new0( struct oauth_info, 1 );
@@ -296,5 +307,11 @@
 	oauth_params_add( &params, "oauth_callback", "oob" );
 	
-	return oauth_post_request( url, NULL, oauth_request_token_done, st );
+	if( !oauth_post_request( url, &params, oauth_request_token_done, st ) )
+	{
+		oauth_info_free( st );
+		return NULL;
+	}
+	
+	return st;
 }
 
@@ -316,10 +333,11 @@
 	
 	st->stage = OAUTH_REQUEST_TOKEN;
-	st->func( st );
+	if( !st->func( st ) )
+		oauth_info_free( st );
 }
 
 static void oauth_access_token_done( struct http_request *req );
 
-void *oauth_access_token( const char *url, const char *pin, struct oauth_info *st )
+void oauth_access_token( const char *url, const char *pin, struct oauth_info *st )
 {
 	GSList *params = NULL;
@@ -328,5 +346,6 @@
 	oauth_params_add( &params, "oauth_verifier", pin );
 	
-	return oauth_post_request( url, &params, oauth_access_token_done, st );
+	if( !oauth_post_request( url, &params, oauth_access_token_done, st ) )
+		oauth_info_free( st );
 }
 
@@ -337,5 +356,5 @@
 	if( req->status_code == 200 )
 	{
-		GSList *params;
+		GSList *params = NULL;
 		const char *token, *token_secret;
 		
@@ -350,4 +369,5 @@
 	st->stage = OAUTH_ACCESS_TOKEN;
 	st->func( st );
+	oauth_info_free( st );
 }
 
@@ -358,7 +378,10 @@
 	GString *ret = NULL;
 	
+	/* First, get the two pieces of info from the access token that we need. */
 	oauth_params_parse( &params, access_token );
 	if( params == NULL )
 		goto err;
+	
+	/* Pick out the token secret, we shouldn't include it but use it for signing. */
 	token_secret = g_strdup( oauth_params_get( &params, "oauth_token_secret" ) );
 	if( token_secret == NULL )
@@ -368,4 +391,5 @@
 	oauth_add_default_params( &params );
 	
+	/* Start building the OAuth header. 'key="value", '... */
 	ret = g_string_new( "OAuth " );
 	for( l = params; l; l = l->next )
@@ -387,4 +411,7 @@
 	}
 	
+	/* Now, before generating the signature, add GET/POST arguments to params
+	   since they should be included in the base signature string (but not in
+	   the HTTP header). */
 	if( args )
 		oauth_params_parse( &params, args );
@@ -396,4 +423,5 @@
 	}
 	
+	/* Append the signature and we're done! */
 	params_s = oauth_params_string( params );
 	sig = oauth_sign( method, url, params_s, token_secret );
Index: lib/oauth.h
===================================================================
--- lib/oauth.h	(revision ee84bdbc2510fa09bd0f67e14d06e69c2626d0f1)
+++ lib/oauth.h	(revision 18dbb20242719f7537ad1a18a9a3befa2eefd502)
@@ -25,5 +25,8 @@
 
 struct oauth_info;
-typedef void (*oauth_cb)( struct oauth_info * );
+
+/* Callback function called twice during the access token request process.
+   Return FALSE if something broke and the process must be aborted. */
+typedef gboolean (*oauth_cb)( struct oauth_info * );
 
 typedef enum
@@ -53,5 +56,5 @@
    authorization URL for the user. This is passed to the callback function
    in a struct oauth_info. */
-void *oauth_request_token( const char *url, oauth_cb func, void *data );
+struct oauth_info *oauth_request_token( const char *url, oauth_cb func, void *data );
 
 /* http://oauth.net/core/1.0a/#auth_step3 (section 6.3)
@@ -59,5 +62,5 @@
    token. This is passed to the callback function in the same
    struct oauth_info. */
-void *oauth_access_token( const char *url, const char *pin, struct oauth_info *st );
+void oauth_access_token( const char *url, const char *pin, struct oauth_info *st );
 
 /* http://oauth.net/core/1.0a/#anchor12 (section 7)
@@ -67,2 +70,5 @@
    automatically be grabbed from url. */
 char *oauth_http_header( char *access_token, const char *method, const char *url, char *args );
+
+/* Shouldn't normally be required unless the process is aborted by the user. */
+void oauth_info_free( struct oauth_info *info );
