more oauth nonsense