now use "sessionToken", not "session"