changes to support OAuth2