add token generation to session service.