added token response body to session POST
added user email PATCH and fixed online users filter