Ignore app/vendor folder
[WIP] use OAuth authentication with popup instead of token