I'm not quite sure how the session token is actually being used in the app. I have created a number of Database Services, and in the Request parameters is "X-Appery-Session-Token". But when I add a datasource to an app page I'm not explicitly mapping up the session token to this parameter, I don't see it getting passed in the HTTP headers on the data request, but data is still being returned. Is it actually required?