get_token password parameter is optional, and not used if session is active