adding ability to only pass an oauth2 token as a means of session creation