renamed AuthToken -> Session