Use apply_omniauth consistently

Previous implementation means we don't get an access_token, and for folks overriding #apply_omniauth.