`get_authorize_url` might not be safe... `oflyUserid` seems better to me.  But I'm not sure it makes a big deal since there's little overhead in just creating the session.  (And in most cases you want to just get the session object once and make all your subsequent calls on that)