Separate oauth tokens from the req.session.user object. Clean up session...

... checking ifs.