experimenting some more with swagger's oauth2 support