Token-based session middleware.