Moved oauth callback logic into sessions controller.