Limiting oauth strategy to authorization_code