simplified design a bit, added oauth support via passport