looks like the session token is not getting attached with the request