Storing in the db against the oreauth session sounds good