I like this, oauth has a certain threshold, whether this can run in the browser or not