oauth applications list, use redirect and error page instead of head response