fix oauth bug with reusing tokens