added a new filter to check that a mostly public request is from an oauth client app