Use cookie tokens rather than session state to cut down on oauth roundtrips