use token as session id for oauth request