[bug fix]use session for token