OAuth tokens are normally single use tokens, aren't they? If so, I'm not sure it makes sense to add them to Session.