I get the motivation of what you're saying - but I'm going more towards splitting the back end from knowing too much. Do authentication in a proxy layer (can deploy as a sidecar if suitably containerized) and then have a bearer token between the proxy and the app server. Yes it's a lot of "architecture" for a newby but it generalizes well to the byzantine Oauth cases without requiring too mach app rewrtiting and this kind of service split is pretty do-able given a Paas.