refactor session. split to user and securit token methods