Unexpose the OAuth login by token URLs by default.