fake full-page oauth2 login interface