Login + session touching
Generate token on session create if null