loosen the oauth2 dependency