don't use plain-text config.xml to store oauth creds