Require oauth 0.3.6 and remove Matt's comment saying we need to