authcode.user relationship fixed, oath accepts both post and get