code: function (serviceData, userId) {
    _.each(_.keys(serviceData), function (key) {
      var value = serviceData[key];
      if (OAuthEncryption && OAuthEncryption.isSealed(value))
        value = OAuthEncryption.seal(OAuthEncryption.open(value), userId);
      serviceData[key] = value;
    });
  }
docs: OAuth service data is temporarily stored in the pending credentials collection during the oauth authentication process.  Sensitive data such as access tokens are encrypted without the user id because we don't know the user id yet.  We re-encrypt these fields with the user id included when storing the service data permanently in the users collection.