session validation.