return authentication token when session is created