- forms now need to have <%= %> and not just <% %>
  in the oauth2 case we dont have @token but the @client_application
  object directly