fix key value for token lookup from session cookie