oauth interface split out, more refactoring