Split out oauth access checking