Providing different access points to end users and clients
Rather than letting both the end users and 3rd party clients use the same URI such as "http://myapp.com/service/calendars/\{id}", one may want to introduce two URIs, one for end users and one for third-party clients, for example, "http://myapp.com/service/calendars/\{id}" - for endusers, "http://myapp.com/partners/calendars/\{id}" - for the 3rd party clients and deploy 2 jaxrs endpoints, where one is protected by the security filter checking the end users, and the one - by OAuth filters.
Additionally the endpoint managing the 3rd party clients will deploy a resource which will offer a resticted URI space support. For example, if the application will only allow 3rd party clients to read calendars then this resource will only have a method supporting @GET and "/calendar/\{id}".