User generates auth token on creation
Session controller verifies url keys