actually look up the session and pass the tenant_id rather than token_id