more work on Oauth, including lots of frustration