Move OAuth/token to the end of the list