fixes to oauth middleware