bandaid patch for session vs token auth issues