fix session token handlering