realised there autologin for oauth is the access token, not the session