fixed oauth flow (hopefully!)