use querystring builtin

as on tin. updates oauth.js to be lazier and abuse a node builtin.