Pop OAuth request token from session on use

If we only get the OAuth request token from the session without removing
it, then it’ll just stay there forever, bloating the session cookie that
gets sent with each request and most responses.