integrate ApiToken with normal session login