OAuth sessions are created before the authorization grant gets actually completed

[sandhose]

For some reason, we're creating the OAuth session (but not the access token nor the device on the HS side) when we fulfill the grant, but not when the token exchanges.

This leads to a weird UX where the session starts appearing in your list even though you haven't completed it