More work on session handling and start oauth