update token in session