new feature: now finds session by unique token