pushed all oauth / api logic to the central server; now distributed server just exposes a simple callback with strong assumptions on the data.