updating validate_user to include session ids