Get current session token

Returns the JWT for the currently authenticated session. Intended for mobile WebView clients that cannot read HTTP-only cookies.