return session token in json object wrapper instead of string