low-security authentication mixed with high security; the idea is to match the consumer's level of oauth2 compliance... the more they comply, the more data they have access to