fixed a bug that a request token won't be cleaned from the session