Token now depends on session id