Using OAuth2 on non-REST endpoints