session token created upon user creation