auth: Force session token update on login