changed advice about passwds, now its oauth2