removed set cookie part and some other cookie related stuff
forgot part of set-cookie to remove
load the session token from the request body
use json session token instead of cookie