rest chnages to be more flexible with missing session token