make oauth2 a runtime dependency