a trivial oauth server (toy)