OAuth2ServiceProvider should become subclass of SecurityServiceProvider?