add csrf protection to oauth identification
don't remember oauth logins (users should rather trust their oauth provider)