Acceptance specs for OAuth