oauth2 vs assertions | What are the differences? | StackShare