adding app auth to oauth call