disable auth token depending on session_id() because sometime this leads to redirect loop