use setup tools + explicit deps
whitespace normalization
better error handling, custom decoder for access-token-requests, pass along authorize_kwargs