switched from cookies to local session token storage