It's not clear to me how your process works exactly. When you say "redirecting to another website which calls back to my web app" do you mean the remote website calls your app? Or that the user is redirected back to your site (which I assume has some token on the querystring?)
There are lots of good examples of how to use OAuth, but if you refuse to follow the typical methods, it will be a lot more difficult.
You need to provide more information on how your handshake works.
Without knowing more, all I can do is guess, in that a new session is being created because something is different about your callback request. You need to figure out what that is.