@kaiser the api only allows a singe oauth domain (subdomains are fine) for the redirect. so to handle things like blog.gaming.stackexchange.com, blog.superuser.com, scifi.blogoverflow.com, etc, instead of using the "local" version of my login page, the login_url filter passes everyone over to blogoverflow.com/path/to/login/page.
In putting this up for testing, I enabled the plugin only on one blog, not the network. Unfortunately, I didn't do it on the blogoverflow.com, but on a child.blogoverflow.com blog. So, the flow got passed to the blogoverflow.com login page, where the plugin wasn't enabled, thus the authentication wasn't running.
Just to calm you down: On an "advanced" level (compared to every day questions on WPSE), you often get to the point, where extremely simple things kill your day: if ( /* some condtion */ ) return; mostly is what destroys an easy tasks "easy" attribute :)
on above - so apparently I am mental case, ungrateful for adjustments team makes to please "my situation" (what situation?)... taking guesses if I am still employed by end of this day :)