generate token raise exception if session id is invalid