Session-based OAuth auth fixes (token expiration check), refactoring, tweaks.