fixed OAuth mess, added client-side user recognition