track session with token

sessions would be recreated if it not tracked, so every request made a
brand new session.