send session token with requests
send ability ids instead of ability names when saving