A token should ofcourse be unique per session, and not per request