Removing JS based OAuth token stripping, moved to server-side