sessions put auth token into json object