testing oauth without session secret