Api handled session token, test loops back token