allow /account/status to be authenticated with a sessionToken