For empty session any token is valid