oauth hash specs