* remove session token replacement code * adds cases for _User/_Session with sessionToken and with/without masterKey