Box.com auth is very tricky