use OAuth2; updated tests to OAuth2