rely less on global state for oauth dance