don't send oauth tokens to profile page