working on oauth2, still, and it sucks