working sessions, not sure if I should be broadcasting same token to everyone tho..