Update oauth.md

added section for access protected resources