working through oauth flow