oauth: interception request