allow oauth authorization over non ssl, but only for cli-token