Within Oauth, what component validates the user's identity?
authorization server
resource server
client
not specified