implement a fake (but currently limited) oauth server