Removed 'express-session' dependency (token only)