OpauthValidator and session persistence