move non-oauth stuff to util pkg