supports `src = "";`
session token