refactored to better modularize auth and not hardcode oauth callback url