Looking at it again. I think it can be quite minimized. There doesn't seem any reason for update_session not to always be true, and for any unforeseeable cases the oauth login should solve that fine. I'll also refactor it to always return a two item tuple, that should make things a bit easier and consistent on the client side. Also, if the session access_token is updated, then the refresh_token has to be as well even if it isn't received to prevent the sessions access_token and refresh_token from belonging to 2 different users.