Session token as authorisation bearer

Original message was deleted