rearranged rules in .htaccess so OAuth is matched before API stuff