examples: access token in session instead of file