Don't call clearCache() when using OAuth

When using OAuth (the host page provides an embedded grant token) don't
call auth.clearCache() on session update. The authorized user never
changes when using OAuth with a grant token embedded in the page, and
the oauth-auth service's clearCache() is a no-op anyway, so there is no
point in calling clearCache() here.

src/sidebar/session.js

@@ -59,6 +59,16 @@ function session($http, $resource, $rootScope, annotationUI, auth,
   var lastLoad;
   var lastLoadTime;
 
+
+  // Return the authority from the first service defined in the settings.
+  // Return null if there are no services defined in the settings.
+  function getAuthority() {
+    if (Array.isArray(settings.services) && settings.services.length > 0) {
+      return settings.services[0].authority;
+    }
+    return null;
+  }
+
   /**
    * @name session.load()
    * @description Fetches the session data from the server.
@@ -79,10 +89,7 @@ function session($http, $resource, $rootScope, annotationUI, auth,
       // the /app endpoint.
       lastLoadTime = Date.now();
       lastLoad = retryUtil.retryPromiseOperation(function () {
-        var authority;
-        if (Array.isArray(settings.services) && settings.services.length > 0) {
-          authority = settings.services[0].authority;
-        }
+        var authority = getAuthority();
         if (authority) {
           return store.profile.read({authority: authority}).then(update);
         } else {
@@ -138,7 +145,9 @@ function session($http, $resource, $rootScope, annotationUI, auth,
     lastLoadTime = Date.now();
 
     if (userChanged) {
-      auth.clearCache();
+      if (!getAuthority()) {
+        auth.clearCache();
+      }
 
       $rootScope.$broadcast(events.USER_CHANGED, {
         initialLoad: isInitialLoad,

src/sidebar/test/session-test.js

@@ -263,6 +263,17 @@ describe('session', function () {
         id: 'anne',
       });
     });
+
+    it('does not clear the access token when the host page provides a grant token', function () {
+      fakeSettings.services = [{
+        authority: 'publisher.org',
+        grantToken: 'a.jwt.token',
+      }];
+
+      session.update({userid: 'different-user', csrf: 'dummytoken'});
+
+      assert.notCalled(fakeAuth.clearCache);
+    });
   });
 
   describe('#dismissSidebarTutorial()', function () {