replace global $sessiontoken scope with $_SESSION