update to latest oauth2 package