prevent creation of session when authenticating with token