add clarification on how Oauth is dealt with