simplify OAuth specs

Session state is now reset between specs, and a common setup helper method is being used.