Bump oauth2 dependency version to include 0.9.x (now required by e.g. omniauth-oauth2)