sessions without r_token