store token in session storage