typo
changed to using the session for the passing of the apiKeyId between /token and /swapToken