[john] - read session token from env in production