Argh. This may be a dead-end for OAuth ...