fixed a bug that the request token won't be cleaned from the session