separate express-oauth into own module, remove extra code