session token is deleted between FriendCirclesController#new and FriendCirclesController#create.