Ok, good - thanks for confirming that. I haven't had to implement Oauth2 quite yet but that was my impression from reading what needed to be done, but that impression was at odds with a lot of internet rants.