Authenticator was granting session tokens left and right, but the bug has now been fixed.