oath works and tokens are stored

still need to find out what happens if already authenticated