added support for actual user sessions through parsing the x-access-token asynchronously then handling the requested service