refactoring oauth2