basic outline for oauth