updated oauth resource protection to actually be oauth resource protection, whoops