You're correct that the string returned by CFUUIDCreateString() was
being leaked, however that's the only leak in this function, and your
change to it would effectively cause the library to stop creating
valid oauth method requests since you've removed the nonce parameter's
value. I went ahead and double checked for any other remaining leaks
by using clang. I've found zero other leaks in the current repository
code(r107), however there is an OS level leak when you perform
synchronous URL requests, so if you're doing that then you'll see that
leak. It's suggested that you always use synchronous network I/O
regardless though so as not to block the UI on slow networks.
_Karl