v0.2.0: support security-token (session-token)