tried unsuccessfully to eliminate client's login

i wanted the only login to be the one to the oauth-srv. but it seems
impossible in the regular use case.