lock oauth-ruby to 0.4.7 until our patch is accepted upstream