add 'none' token and associated parser and expression
use constant for session cookie name