remove token grab from sessions controller