both apps now share a session and authenticity token