Don't pass flag, read it directly
Add first step of OAuth dance for user auth
Handle bare API-only calls