Added note on session access token storage