[bug fix] do not save authToken in session