User can create and destroy session using oAuth