Can you explain the difference between token-based and session-based single sign on implementation for modern web-based retail applications?