acts as a proper oauth endpoint, methinks