fix token session creation bug