Handling oauth2 auth for single page apps when your api server needs offline access tooc