The OAuth 1.0a advisory was made in April/June - we need to update the implementation to (optionally) support these changes, while still remaining backward compatible with OAuth 1.0 implementations as well.

OAuth 1.0a changes were implemented a few months ago - people seem to be happy with it, so marking this issue as fixed.