part 3: authenticating with oauth2