login defaults to oauth/authorize