refactor sessions controller oauth