ensure session token is saved with user before returning