using session id and token - ZITADEL