Turns out you were overriding `oauth` below. No tests detected this. 
We're a bit poor on coverage.