Within Oauth, what component validates the user's identity?
resource server
authorization server
not specified
client