changed sdk to use the word token and forced it to make a CORS req to establish session asymilation on first request