CLOUD-216 auth code oauth flow - tokens are saved in session