implemented oauth flow but not resource requests