make oauth2 token endpoint configurable