Why Agents Hate OAuth