Since you can use an OAuth token as a password for user auth, should we call this `basic_oauth_app_client` since this is application auth?