assets base64 & token sessions