improve oauth2_callback logic