fix: session token