Part 4: The OAuth dance