As noted in PR feedback, the OAuth token key should be based on the
annotation service rather than just authority. The annotation service is
currently identified by (API domain, authority) but in future we'll
likely integrate the authority into the API URL for 3rd-party accounts
(eg.  "https://publisher.hypothes.is/api").