oauth solution without using client_id or client_secret (no way for it to be secure)