factored out oauth header building code.