add session management with token and authentication