added user session token auth