oauth_consumer_key and oauth_consumer_secret have default values in the codebase, which should be removed to require users to supply their own values.

Note that this only affects a source or basic package install, and OAuth is disabled anyway. The default installer run will randomise these passwords before enabling it.