* add start,end with transfer.index.fullmatch get

* bugfix: should cleanup token before destory session when auth.extra.mode.enable