not using client secrets, since the signed oauth is good enough
Merge pull request #659 from shatterednirvana/use-oauth2-if-no-secrets

not using client secrets, since the signed oauth is good enough