extract TokenStore from Session constructor into setter