don't unnecessarily verify auth token on session sign in