reworked three-legged oauth1a to use new Curl class