no token in session error should be handled same as invalid token