more skeleton work - oauth authentication