In case the user is logged in: should we double check the session belongs to the the user in ````$_SERVER["PHP_AUTH_USER"]````

We have such a check in place afaik - the question is if this check is executed in case of basic auth