make oauth flow more flexible to override