Shouldn't we clear the session in all (fail) cases? (eg: also if check_token is false). Minor anyhow...