* checking auth code and returning session token if not expired