https://demaskey.com/oauth-2-flows/