added basic OAuth, fixed some client side bugs