redirect to main with session token