Return and delete session in validateAuthCallback

[Paulinakhew]

WHY are these changes introduced?

• Consider whether it is possible to never fall back to loading the current session from a cookie on embedded apps (and make sure we expire the OAuth cookie right away).

WHAT is this pull request doing?

• returns the current session at the end of validateAuthCallback
• immediately destroy the cookie session for embedded apps to help prevent build-up

Type of change

• Patch: Bug (non-breaking change which fixes an issue)
• Minor: New feature (non-breaking change which adds functionality)
• Major: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• I have added a changelog entry, prefixed by the type of change noted above
• I have added/updated tests for this change
• I have documented new APIs/updated the documentation for modified APIs (for public APIs)

Note to self

    // Begin auth
    // Check that we DO have a cookie (that expires 1m in the future with grace period)
    // Set up the test callback query
    // Call validateAuthCallback
    // Check that the cookie has the right id
    // Check that the cookie has the right expiration date
    // expect(cookies.expires).toBe("the right value");

[Paulinakhew]

Hi @paulomarg I still need to write tests but I'm re-requesting your review

[mkevinosullivan]

LGTM - one small note