minor updates to OAuth