move token from session to params