begin of oauth2 - 403 when no acess token
remove entry point logic
some fixes
fix route
oauth with authorization header ok
Merge remote-tracking branch 'origin/oauth2'