move set_session_token to callback