There are also a lot of web sites that store that same access token in plain text cookies...

Well done for discovering the hole and the way you handled it. Glad to see you wearing that white hat!