login.md: notes on OAuth