new type for session token; improvements to lists api