secure javascript client oauth2 with yql