work on oauth
switch to ejs, remove keys
Merge remote-tracking branch 'origin/master'