Clean up some detritus, specifically:

* /search.json was a lie -- we return html partials. now just /search
* Interaction with twitter OAuth cleaned up. No more direct session var access outside of twitter_access.rb