move oauth.rb into api