fetch('/session', {credentials: 'same-origin', headers: {'X-Requested-With': 'XMLHttpRequest'}})
.then(res => res.json())
.then(data => data.user.token)
.then(token => console.log(token));

Avoiding Big Chungus.