Oops had to turn off HTTPS redirect - was breaking OATH