update to newer DBAL and oauth-server (though DBAL is still ancient)