switch to using swagger security spec for oauth