Fix Token bug in SessionController