Add sessionToken to users and fix bugs around updates