OAuth delegation pages should have an explicit "Deny Authorization" option, not just "Authorize". Timeout and "Whoa, no way!" are different.