Update: Does authentication itself

Now opens the request url in browser
spawns a server to take in access_token
bug fix: wasn't asking for extended permission, now it does