add xoauth2 to Authentication

to close #210