alias security token to session token