Use original URI, not rewritten version, to check oauth