Move the session token to a Header and use SecurityContext and appropriate filters.

[MikeNeilson]

or use App Server (Jetty, Tomcat, etc) managed tokens instead.

[MikeNeilson]

For reference: https://eclipse-ee4j.github.io/jersey.github.io/documentation/latest/security.html