added support for oauth2 bearer tokens (app-only auth)