don't use authToken in base authenticator
don't rewrite server response for OAuth2
use OAuth2 terminology consistently
fixed examples