oauth querystring signing