Now using session tokens to authenticate users