session token hashcoded