token/session methods in web.rb