on second thoughts, this is provider-specific session data, so I guess for these keys we should use sthg like `<provider-name>.<key>`, such as `github.oauth-token`.