working on a sound oauth/api strategy