Update Opauth.php

we only start session if it's not running, but we set $response no matter who stared the session