session token and user_serializer