Security tokens are now generated and validated by the session class