update session and token