use the oauth token when shelling out