moving where token is added to session