headless oauth2.0 test using spooky