# session vs token