we are still (co?-)dependent on oauth2 via 'curling'.
also fix typo in oauth tests