session and user token bug fixes