append auth token to request params if there is an active session