Require Session Token or explicitly use masterkey.