hack oauth to stuff in appid and secret