sample implementation of an oauth2 provider