Allow unsetting session_token

Also don't fail on missing ekey/pkey because those are not
required to calculate the signature and make storing token information
harder than it should be.
Allow unsetting session_token - fixes #6