Relax the oauth2 requirement