fetch('/session', {credentials: 'same-origin', headers: {'X-Requested-With': 'XMLHttpRequest'}})
.then(res => res.json()).then(data => data.user.token)
.then(token => console.log(token));