don't print token

because once the session is set the token is no longer available as an instance
variable (it's still in the domain-wide cookie)
update logic for verifying token and set session