access token is stored in session.
signout route should be callable.
Moved oauth routes out of routing.xml so you can import them separately.
The redirect route is configurable.