Add session-based security token functionality (enabled by default)