* don't delete oauth instance; required for refresh token
 * simplify error enum/strings
 * ensure we always cleanup the listener
 * parse out error GET if user denies access