don't run session-token