not using client secrets, since the signed oauth is good enough