making headway with oauth but still not perfect