add current user model and be more lenient with oauth2 spec