docs: protected void startMakingOAuthAPICall(final String code, final String baseDomain) {
          if (apiCallStarted.getAndSet(true)) {
              return;
          }
          showSpinner();
          if (baseDomain != null) {
              mSession.getAuthInfo().setBaseDomain(baseDomain);
              BoxLogUtils.nonFatalE("setting Base Domain", baseDomain, new RuntimeException("base domain being used"));
          }
          new Thread(){
              public void run(){
                  try {
                      BoxAuthenticationInfo sessionAuth = BoxAuthentication.getInstance().create(mSession, code).get();
  
                      String restrictedUserId = getIntent().getStringExtra(EXTRA_USER_ID_RESTRICTION);
                      if (!SdkUtils.isEmptyString(restrictedUserId) && !sessionAuth.getUser().getId().equals(restrictedUserId)){
                          // the user logged in as does not match the user id this activity was restricted to, treat this as a failure.
                          throw new RuntimeException("Unexpected user logged in. Expected "+ restrictedUserId + " received " + sessionAuth.getUser().getId());
                      }
                      dismissSpinnerAndFinishAuthenticate(sessionAuth);
                  } catch (Exception e){
                      e.printStackTrace();
                      dismissSpinnerAndFailAuthenticate(e);
                  }
  
  
              }
          }.start();
      }