added checks for bad session token