replace session storage for token and csrf support