take card abilities as json string instead of array. accept session-token from header instead of body