updated _processRequest with session tokens