store token in .sessionStorage.token