The auth storage should always check if the HTTP request is valid

Author: Ocramius

src/ZfrOAuth2Module/Server/Authentication/Storage/AccessTokenStorage.php

@@ -82,6 +82,10 @@ private function getCurrentRequest()
     {
         $request = $this->application->getMvcEvent()->getRequest();
 
-        return $request instanceof Request ? $request : null;
+        if (! $request instanceof Request || ! $this->resourceServer->isRequestValid($request)) {
+            return null;
+        }
+
+        return $request;
     }
 }