correct checking for session token config