added session token authentication