update the OAuth demo app to first require login to the app to determine where to bind the tokens to, more real life scenario