put token into session cookie