revise code sample to ensure oauth2 login via authorization server