tossing the flasky thing, wasn't actually necessary. aside from one bug, the trick seems to have been use POST with Content-Type set to text/plain to avoid triggering implicit behavior in oauth2. trash heap city.