issue #20559: priv control for oauth2 clients