Switching two checks for sessionkey and token to '==='-strict.