change routes for auto test
make the confirm authorization request a function
require oauth pass the request object to api handler
logging on request validator
control token expires in