/posts route requires session token to get posts