User profile in nav and oauth token is now sent as a session cookie.