use short-lived session to persist omniauth data thru internal redirect