[#8367] latest oauth2 isn't on pypi, only github.  And fix an API test
diff --git a/Allura/allura/controllers/rest.py b/Allura/allura/controllers/rest.py
index ee6548e..6072c6f 100644
--- a/Allura/allura/controllers/rest.py
+++ b/Allura/allura/controllers/rest.py
@@ -399,7 +399,7 @@
         if 'doap' in kw:
             response.headers['Content-Type'] = str('')
             response.content_type = str('application/rdf+xml')
-            return '<?xml version="1.0" encoding="UTF-8" ?>' + c.project.doap()
+            return b'<?xml version="1.0" encoding="UTF-8" ?>' + c.project.doap()
         return c.project.__json__()
 
     @expose('json:')
diff --git a/requirements.in b/requirements.in
index 10f85c7..759d91a 100644
--- a/requirements.in
+++ b/requirements.in
@@ -20,8 +20,10 @@
 markdown-checklist==0.4.1
 MarkupSafe
 Ming==0.5.7
-# oauth2 doesn't have py3.6 support.  There's a fork with fixes but no pypi releases I can find.  https://github.com/joestump/python-oauth2/issues/223
-oauth2
+# TODO: move to "oauthlib" instead
+# oauth2 doesn't have a release with py3.6 support, but does have fixes on master:
+# archive/.../.zip URL is preferable over git+https://... since it supports pip hash generating+checking
+https://github.com/joestump/python-oauth2/archive/b94f69b1ad195513547924e380d9265133e995fa.zip#egg=oauth2
 paginate
 Paste
 PasteDeploy
diff --git a/requirements.txt b/requirements.txt
index 4030d32..a24ec2c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -50,7 +50,7 @@
 ming==0.5.7               # via -r requirements.in
 mock==3.0.5               # via -r requirements.in
 nose==1.3.7               # via -r requirements.in
-oauth2==1.9.0.post1       # via -r requirements.in
+https://github.com/joestump/python-oauth2/archive/b94f69b1ad195513547924e380d9265133e995fa.zip#egg=oauth2  # via -r requirements.in
 oauthlib==3.0.2           # via requests-oauthlib
 paginate==0.5.6           # via -r requirements.in
 paste==3.1.0              # via -r requirements.in, easywidgets, pastescript