better handling of oauth login