changed session key to use secret token from the database