derive hawk credentials from sessionToken