moved oauth logic from api to OAuthServerBundle