title: How important is it to keep OAuth's access token secret?
body: <p>Once I receive my access token for a site (say facebook) using OAuth, how important is it to keep this secret? Could anything malicious happen if someone got a hold of one?</p>
  
  <p>I was wondering if it would be a bad idea to save the token in a cookie or session. </p>