always set oauth token, logged in or not. this ensures that it is cleared on logout