modify sessions -> api_tokens