fixed stale tokens causing session to think it's authenticated