diff --git a/src/api/model/active_user_manager.rs b/src/api/model/active_user_manager.rs
index 3e9f7f02c..6630befb6 100644
--- a/src/api/model/active_user_manager.rs
+++ b/src/api/model/active_user_manager.rs
@@ -209,17 +209,16 @@ impl ActiveUserManager {
     }
 
     pub async fn create_user_session(&self, user: &ProxyUserCredentials, virtual_id: u32, provider: &str, stream_url: &str, connection_permission: UserConnectionPermission) -> Option<u32> {
+        self.gc().await;
         let mut lock = self.user.write().await;
         if let Some(connection_data) = lock.get_mut(&user.username) {
             let session = Self::new_user_session(virtual_id, provider, stream_url, connection_permission);
-            self.gc().await;
             let token = session.token;
             connection_data.sessions.push(session);
             Some(token)
         } else {
             let mut connection_data = UserConnectionData::new(0, user.max_connections);
             let session = Self::new_user_session(virtual_id, provider, stream_url, connection_permission);
-            self.gc().await;
             let token = session.token;
             connection_data.sessions.push(session);
             lock.insert(user.username.to_string(), connection_data);
@@ -275,6 +274,7 @@ impl ActiveUserManager {
                 for (_, connection_data) in lock.iter_mut() {
                     connection_data.sessions.retain(|s| current_time_secs() - s.ts < 10_800);
                 }
+                gc_ts.store(current_time_secs(), Ordering::SeqCst);
             }
         }
     }
diff --git a/src/processing/parser/hls.rs b/src/processing/parser/hls.rs
index eb4cf8a9a..626bc48e6 100644
--- a/src/processing/parser/hls.rs
+++ b/src/processing/parser/hls.rs
@@ -6,16 +6,18 @@ use std::str;
 
 fn create_hls_session_token_and_url(secret: &[u8], session_token: u32, stream_url: &str) -> Option<String> {
     let token = hash_utils::u32_to_base64(session_token);
-    if let Ok(cookie_value) = obfuscate_text(secret, &format!("{token}@{stream_url}")) {
+    if let Ok(cookie_value) = obfuscate_text(secret, &format!("{token}{stream_url}")) {
         return Some(cookie_value);
     }
     None
 }
 
+const TOKEN_LEN: usize = 6;
 pub fn get_hls_session_token_and_url_from_token(secret: &[u8], token: &str) -> Option<(Option<u32>, String)> {
     if let Ok(decrypted) = deobfuscate_text(secret, token) {
-        let (session_token, stream_url) = decrypted.split_once('@')?;
-        return Some((hash_utils::base64_to_u32(session_token), stream_url.to_owned()));
+        let session_token: String = decrypted.chars().take(TOKEN_LEN).collect();
+        let stream_url: String = decrypted.chars().skip(TOKEN_LEN).collect();
+        return Some((hash_utils::base64_to_u32(&session_token), stream_url));
     }
     None
 }
@@ -96,3 +98,18 @@ pub fn rewrite_hls(user: &ProxyUserCredentials, props: &RewriteHlsProps) -> Stri
     result.push("\r\n".to_string());
     result.join("\r\n")
 }
+
+#[cfg(test)]
+mod test {
+    use rand::RngCore;
+    use crate::utils::hash_utils;
+
+    #[test]
+    fn test_token_size() {
+        for _i in 0..10_000 {
+            let session_token = rand::rng().next_u32();
+            assert_eq!(hash_utils::u32_to_base64(session_token).len(), 6);
+        }
+    }
+
+}
\ No newline at end of file