Thorough session destruction, update README/TODO

+1 for oauth . Have used one earlier https://github.com/Lusitanian/PHPoAuthLib ( there is an optional dependency added by symfony people on http-foundation though it is really not necessary https://github.com/Lusitanian/PHPoAuthLib/issues/159 ) another implementation is https://github.com/thephpleague/oauth2-client ( but only oauth 2.0 ) . I prefer Lusitanian .

Do you have any other things in mind?