cache the token for the authenticated request instead of putting it in the session