fixed oauth flow with new server requirements