handle token refresh in the session
cleanup