Google will shortly require that applications that access restricted scopes must pass an annual security assessment and obtain a Letter of Assessment from a Google-designated third party. So, I'm going to disable the Google App Engine OAuth proxy (i.e., put it to test mode) and require a client_id/client_secret to access Google Drive.