sessions is now working, need to return token for future requests instead of cookie