getting three legged auth working