restructuring to keep session token info separate