removing redirect header hack, passing oauth_params around explicitly