Fixed bug in session token match