Also cache DropboxSession on Flask.g not class instance. The token is registered on this instance, and it must not be shared between users.