first draft of oauth2 SSO, sync tags built in