inject session in OAuth2Module