fake redirect-based Google Oauth2