update oauth logic to use session