using usertokenid in security/session map