A todo list REST backend with OAuth2