fix logic bug returning filters; allow GET parameters for OAuth2; hooks for bearer auth headers
allow oauth2 to be both more liberal and more strict