fixed a bug where sessions without tokens would time out