You must check that the user is authenticated and that he owns the session