user cannot post office hours now without session token