fix(oauth): move auth service endpoint to locals.js