bump dependency on oauth2 to 0.9.x, removing monkey-patch