Don't store session token in warden session to avoid set_user being called