JSession rather than JRequest for checkToken