generic oauth controller