more sensible oauth routes
only store target url in session if there seems to be one
adding facebook and google oauth strategies
normalize google OpenId profile