Add 3-legged oauth tests and minor fix