Add note about OAuth 2 requirement for web apps