initial oauth endpoints