Updated note on OAuth