Removed token injection into session during login call