experimental tentative support for user defined oauth app client/secrets
npm bump