update api oauth2 docs, mention basic digest request