dynamic token in session