add shoot-oauth2 internal bearerOnly app