remove hard-coded oauth2 client id and secret