clarify oauth section of readme