Invalid Session response after upgrade

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

I've updated my parse server JS sdk to the latest versions and I'm quite often getting an invalid session error now. For my setup I am having customers purchase something and I am storing the purchased product, which is a parse object, as a JSON representation with each purchase. This is done so that I have the exact purchased product at the time of the purchase. Additionally, I have FAQs and Tags attached to my product as an array of pointers. These are fetched and also stored with the purchase object.

After updating to the latest parse server and js sdk version, the invalid session token error keeps popping up. In my console output I see that parse always uses an old specific session token that is not valid anymore. It looks like once I query purchases and parse sees my user either in the tags, faqs or somewhere else in the purchase it returns the data with the old session token in there. The client parse js sdk then falsely uses that expired token for its next request which then fails.

Steps to reproduce

1. Have class like tags with a author field and your userid as a pointer in it.
2. Use another class called items and link to the tags as an array of pointers.
3. Create a purchases class and have a field that stores objects.
4. fetch the array of pointers on the item class with include and store the completely fetched object in the purchases class.
5. Delete all sessions and log in again
6. Query the purchases class and display the data
7. Query something else and you get an invalid session token response

Actual Outcome

Invalid Session error for the next request. Upon reloading the page it works again.
{"message":"Parse error: Invalid session token","code":209,"level":"error","stack":"Error: Invalid session token\n at Object.getAuthForSessionToken (/var/www/vhosts/programmieren-muenchen.de/parse/server/node_modules/parse-server/lib/Auth.js:114:11)\n at runMicrotasks ()\n at processTicksAndRejections (internal/process/task_queues.js:95:5)"}

Expected Outcome

Continue using the session token that was created upon login and is stored in the browser localstorage.

Environment

Server:
Node v14.17.3
Parse 3.3.0
Parse-Server 4.10.3
Running on an express server with ubuntu 18.04

Client:
Nuxt 2.13.3
Parse 3.2.0

Server

• Parse Server version: 3.3.0
• Operating system: Ubuntu 18.04
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Remote Ubuntu vhost Server

Database

• System (MongoDB or Postgres): MongoDB
• Database version: 4.4
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Remote Ubuntu vhost Server

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): JavaScript
• SDK version: 3.2.0

Logs

{"message":"Parse error: Invalid session token","code":209,"level":"error","stack":"Error: Invalid session token\n at Object.getAuthForSessionToken (/var/www/vhosts/programmieren-muenchen.de/parse/server/node_modules/parse-server/lib/Auth.js:114:11)\n at runMicrotasks ()\n at processTicksAndRejections (internal/process/task_queues.js:95:5)"}

Start with the stack trace at parse-server/lib/Auth.js:114 and reproduce the listed sequence involving included pointers, stored purchase objects, deleted sessions, and a subsequent query. Trace which session token is used after login; done means the next request continues using the current browser session token instead of returning code 209.