moved code out of OAuthAuthenticator, made it a param of Authorize