cleaned up security oauth code