Session token setting on token exchange. Auth-related refactoring.