Oauth controller should be accessible for non-enrolled users; it's for
researchers/admins.