don't send hashes in urls to oauth