session clear preserves token now, and token login was changed from insecure to secure