handle /session/ and /oauth/:provider routes before handling oauth2