Authenticate by token and session. Fixes #7