use WIF's settings for session token flags (remove hard coded values)