SIFR Editor OAuth — endpoints: /auth, /callback