null session for invalid auth token