move the session tokens to the session model