do we really need to CGI escape
refactor session storage to store clever id rather than oauth token