include session token while signing request