Updated auth.token filter to use session header