Reuse validator and oauth_endpoint in auth server

Instead of recreating the validator and oauth_endpoint for each request,
just keep them around and call validator.set_session(session).