don't keep unsecure session token