Use window explicitely.
Do not output token in simulate_url if session is None.