update session and routes for getting new token with refresh