refactored session and tokenHandler into sessionHandler, tests pending