> OAuth tokens are normally single use tokens, aren't they? If so, I'm not sure it makes sense to add them to Session.

Yeah we wouldn't need to store the oAuth token. We would need to persist the client_id at the very least and maybe other data that comes back from `getClientInfo`. There's no real need to do this for a simple sign in since there's only one view involved, but as soon as we tackle sign up or allowing password resets in the middle of the flow, we'll need to be keeping track of the site through which they initiated the flow.