which might be a bug.. cause if it's a different way for session verification, then our refresh API shouldn't be called.