separate oauth2 support from core and use json4s for parsing